CVE-2026-72535: Chaskiq Authentication Bypass Vulnerability

CVE-2026-72535 Overview

CVE-2026-72535 is a missing authentication vulnerability [CWE-306] in Chaskiq, an open-source customer messaging platform. The flaw exists in the stripeCustomerPortal GraphQL mutation, which fails to enforce authentication or authorization before creating a Stripe Billing Portal session. Unauthenticated remote attackers can mint portal sessions for any tenant Stripe account. This enables adversaries to view and manipulate subscription data across tenants without valid credentials. The issue affects Chaskiq through commit 46dfdd1.

Critical Impact
Unauthenticated attackers can generate Stripe Billing Portal sessions for arbitrary tenants, exposing billing data and enabling subscription tampering across the platform.

Affected Products

Chaskiq customer messaging platform
All builds through commit 46dfdd1
Deployments exposing the GraphQL endpoint to untrusted networks

Discovery Timeline

2026-08-11 - CVE-2026-72535 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72535

Vulnerability Analysis

The vulnerability resides in the GraphQL API layer of Chaskiq. The stripeCustomerPortal mutation accepts requests without validating the caller's identity or role. When invoked, it calls the Stripe API to create a Billing Portal session tied to a tenant-supplied identifier.

Because no session token, API key, or tenant membership check gates the mutation, any network-adjacent client can request portal URLs for tenants they do not own. The returned Stripe portal session grants access to subscription details, payment methods, invoice history, and cancellation controls.

The attack requires only network access to the Chaskiq GraphQL endpoint. Exploitation is scriptable and produces valid Stripe-hosted URLs that appear legitimate to end users and support teams.

Root Cause

The root cause is a missing authentication check [CWE-306] on a privileged GraphQL mutation. Chaskiq's resolver for stripeCustomerPortal omits the authentication guard applied to other billing-related resolvers. The mutation trusts the tenant identifier supplied in the request payload rather than deriving it from an authenticated session context.

Attack Vector

An attacker sends a crafted GraphQL POST request to the Chaskiq API endpoint invoking the stripeCustomerPortal mutation with a target tenant identifier. The server issues a Stripe API call and returns a signed Billing Portal URL. The attacker then loads the URL in a browser to gain access to the tenant's subscription management interface.

See the GitHub Chaskiq Repository for source-level context on the affected resolver.

Detection Methods for CVE-2026-72535

Indicators of Compromise

Unauthenticated POST requests to the GraphQL endpoint containing the stripeCustomerPortal operation name
Stripe Billing Portal session creation events for tenants without corresponding user login activity
GraphQL requests referencing tenant identifiers that do not match the source IP's known session history
Outbound Stripe API traffic from Chaskiq application servers that lacks a preceding authenticated request

Detection Strategies

Enable request-level logging on the GraphQL endpoint and alert on stripeCustomerPortal invocations lacking a session cookie or bearer token
Correlate Stripe webhook billing_portal.session.created events with Chaskiq authentication logs to detect orphaned sessions
Deploy web application firewall rules to inspect GraphQL request bodies for the vulnerable mutation name

Monitoring Recommendations

Audit Stripe Dashboard activity for portal sessions initiated outside expected business hours or from unfamiliar IP addresses
Track subscription state changes (cancellations, plan downgrades, payment method updates) and validate them against tenant admin actions
Forward Chaskiq application and reverse proxy logs to a centralized analytics platform for cross-tenant anomaly detection

How to Mitigate CVE-2026-72535

Immediate Actions Required

Restrict network access to the Chaskiq GraphQL endpoint using authenticated reverse proxies or IP allowlists until a patch is applied
Rotate Stripe API keys used by Chaskiq and review recent Billing Portal session logs for unauthorized activity
Disable or block the stripeCustomerPortal mutation at the API gateway if patching is not immediately feasible

Patch Information

No official patched release is referenced in the NVD entry at publication. Monitor the GitHub Chaskiq Repository for commits addressing authentication on the stripeCustomerPortal resolver, and apply fixes as they become available.

Workarounds

Add an authentication guard to the resolver requiring a valid session and tenant membership before invoking the Stripe API
Deploy a GraphQL middleware that rejects requests to billing mutations without an authenticated user context
Front the Chaskiq deployment with a reverse proxy that enforces authentication on /api/graphql routes

bash

# Example nginx configuration to require an auth subrequest before GraphQL access
location /api/graphql {
    auth_request /auth;
    proxy_pass http://chaskiq_backend;
}

location = /auth {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
}